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Claims 

What is claimed is: 

1 . A method of operating a storage system, comprising: 

storing a plurality of data blocks having a horizontal redundant relationship; 

5 storing a plurality of checksums, each checksum having a vertical redundant relationship 

with a corresponding one of the plurality of data blocks; and 

in response to detection of a data integrity error in at least one of the plurality of data 
blocks, reviewing the vertical redundant relationships between each of the 
checksums in the plurality of checksums and the corresponding data blocks. 

10 

2. The method of Claim 1, wherein: 

said reviewing the vertical redundant relationships comprises calculating a new checksum 
for each of the data blocks in the plurality of data blocks and comparing the 
calculated new checksum to the checksum from the plurality of checksums 
1 5 corresponding to that data block. 



3. The method of Claim 1, wherein: 

said storing the plurality of checksums comprises storing the plurality of checksums such 
that each data block in the plurality of data blocks has a vertical redundant 
20 relationship with a set of corresponding checksums, and each of the checksums in 

the set of corresponding checksums has a horizontal checksum redundant 
relationship with the other checksums in the set of corresponding checksums. 

4. The method of Claim 3, further comprising: 
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in response to detecting a first data integrity error between a first data block and a first 
checksum from a first set of checksums corresponding to the first data block, 
reviewing the vertical redundant relationship between the first data block and the 
remaining checksums in the first set of checksums; and 

in response to detecting no data integrity errors between the first data block and the 
remaining checksums in the first set of checksums, creating a restored first 
checksum to replace the first checksum corresponding to the first data integrity 
error. 

The method of Claim 1, further comprising: 

in response to detection of a data integrity error in at least one of the plurality of data 
blocks, reviewing the horizontal redundant relationship between the data block 
having the data integrity error and the remaining data blocks in the plurality of 
data blocks. 

The method of Claim 5, wherein: 

said plurality of data blocks comprises a plurality of data stripe units and a parity stripe 
unit; and 

said reviewing the horizontal redundant relationship comprises calculating a new parity 
stripe unit based on the plurality of data stripe units and comparing the calculated 
new parity stripe unit to the parity stripe unit from the plurality of data blocks. 

The method of Claim 5, wherein: 

said plurality of data blocks comprises a first mirrored data block and a corresponding 
second mirrored data block; and 
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said reviewing the horizontal redundant relationship comprises comparing the first 
mirrored data block and the second mirrored data block. 

8. The method of Claim 5, further comprising: 

5 in response to detecting a first data integrity error in exactly one of the vertical redundant 

relationships and detecting no data integrity errors in the horizontal redundant 
relationship, creating a restored checksum using the data block corresponding to 
the first data integrity error to replace the existing checksum corresponding to the 
first data integrity error. 

10 

9. The method of Claim 5, further comprising: 

in response to detecting a first data integrity error in exactly one of the vertical redundant 
relationships and detecting a second data integrity error in the horizontal 
redundant relationship, creating a restored data block using the horizontal 
15 redundant relationship to replace the data block corresponding to the first data 

integrity error and comparing the restored data block to the checksum 
corresponding to the first data integrity error. 

10. The method of Claim 9, further comprising: 

20 in response to a mismatch between the restored data block and the checksum 

corresponding to the first data integrity error, creating a restored checksum using 
the restored data block to replace the checksum corresponding to the first data 
integrity error. 

25 11. The method of Claim 5, further comprising: 
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in response to detecting a first data integrity error in a first vertical redundant 

relationship, detecting a second data integrity error in a second vertical redundant 
relationship, and detecting no data integrity errors in the horizontal redundant 
relationship, reporting a data loss condition. 



The method of Claim 5, further comprising: 

in response to detecting a first data integrity error in a first vertical redundant 

relationship, detecting a second data integrity error in a second vertical redundant 
relationship, and detecting a third data integrity error in the horizontal redundant 
relationship: 

creating a first restored data block using the horizontal redundant relationship to 
replace the data block corresponding to the first vertical redundant 
relationship; 

comparing the first restored data block to the checksum corresponding to the first 
vertical redundant relationship; 

creating a second restored data block using the horizontal redundant relationship 
to replace the data block corresponding to the second vertical redundant 
relationship; and 

comparing the second restored data block to the checksum corresponding to the 
second vertical redundant relationship. 

The method of Claim 12, further comprising: 

reporting a data loss condition in response to either: 

(a) a mismatch between the first restored data block and the checksum 

corresponding to the first vertical redundant relationship and a mismatch 
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between the second restored data block and the checksum corresponding 
to the second vertical redundant relationship; or 

(b) a match between the first restored data block and the checksum corresponding 
to the first vertical redundant relationship and a match between the second 
restored data block and the checksum corresponding to the second vertical 
redundant relationship. 

The method of Claim 12, further comprising: 

in response to a match between the first restored data block and the checksum 

corresponding to the first vertical redundant relationship and a mismatch between 
the second restored data block and the checksum corresponding to the second 
vertical redundant relationship, creating a restored checksum using the second 
restored data block to replace the checksum corresponding to the second vertical 
redundant relationship. 

The method of Claim 1 , further comprising: 

in response to detecting data integrity errors in at least three of the vertical redundant 
relationships, reporting a data loss. 

A storage system, comprising: 

a storage array comprising a plurality of storage devices; 

a plurality of data blocks having a horizontal redundant relationship, each data block 
stored on one of the plurality of storage devices; 

a plurality of checksums, each checksum having a vertical redundant relationship with a 
corresponding one of the plurality of data blocks; and 
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an array manager coupled to the storage array, wherein said array manager is configured 
such that in response to detection of a data integrity error in at least one of the 
plurality of data blocks, said array manager reviews the vertical redundant 
relationships between each of the checksums in the plurality of checksums and the 
corresponding data blocks. 

The storage system of Claim 16, wherein: 

said array manager is configured to review the vertical redundant relationships by 

calculating a new checksum for each of the data blocks in the plurality of data 
blocks and comparing the calculated new checksum to the checksum from the 
plurality of checksums corresponding to that data block. 

The storage system of Claim 16, wherein: 

each data block in the plurality of data blocks has a vertical redundant relationship with a 
set of corresponding checksums, and each of the checksums in the set of 
corresponding checksums has a horizontal checksum redundant relationship with 
the other checksums in the set of corresponding checksums. 

The storage system of Claim 1 8, wherein: 

said array manager is configured such that in response to detecting a first data integrity 

error between a first data block and a first checksum from a first set of checksums 
corresponding to the first data block, said array manager reviews the vertical 
redundant relationship between the first data block and the remaining checksums 
in the first set of checksums; and 

said array manager is further configured such that in response to detecting no data 

integrity errors between the first data block and the remaining checksums in the 
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first set of checksums, said array manager creates a restored first checksum to 
replace the first checksum corresponding to the first data integrity error. 

20. The storage system of Claim 16, wherein: 

5 said array manager is configured such that in response to detection of a data integrity 

error in at least one of the plurality of data blocks, said array manager reviews the 
horizontal redundant relationship between the data block having the data integrity 
error and the remaining data blocks in the plurality of data blocks. 



10 21. The storage system of Claim 20, wherein: 

said plurality of data blocks comprises a plurality of data stripe units and a parity stripe 
unit; and 

said array manager is configured to review the horizontal redundant relationship by 

calculating a new parity stripe unit based on the plurality of data stripe units and 
1 5 comparing the calculated new parity stripe unit to the parity stripe unit from the 

plurality of data blocks. 



22. The storage system of Claim 20, wherein: 

said plurality of data blocks comprises a first mirrored data block and a corresponding 
20 second mirrored data block; and 

said array manager is configured to review the horizontal redundant relationship by 
comparing the first mirrored data block and the second mirrored data block. 



23. The storage system of Claim 20, wherein: 
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said array manager is configured such that in response to detecting a first data integrity 
error in exactly one of the vertical redundant relationships and detecting no data 
integrity errors in the horizontal redundant relationship, said array manager 
creates a restored checksum using the data block corresponding to the first data 
integrity error to replace the existing checksum corresponding to the first data 
integrity error. 

The storage system of Claim 20, wherein: 

said array manager is configured such that in response to detecting a first data integrity 
error in exactly one of the vertical redundant relationships and detecting a second 
data integrity error in the horizontal redundant relationship, said array manager 
creates a restored data block using the horizontal redundant relationship to replace 
the data block corresponding to the first data integrity error and compares the 
restored data block to the checksum corresponding to the first data integrity error. 

The storage system of Claim 24, wherein: 

said array manager is configured such that in response to a mismatch between the 

restored data block and the checksum corresponding to the first data integrity 
error, said array manager creates a restored checksum using the restored data 
block to replace the checksum corresponding to the first data integrity error. 

The storage system of Claim 20, fiirther comprising: 

said array manager is configured such that in response to detecting a first data integrity 
error in a first vertical redundant relationship, detecting a second data integrity 
error in a second vertical redundant relationship, and detecting no data integrity 
errors in the horizontal redundant relationship, said array manager reports a data 
loss condition. 
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27. The storage system of Claim 20, wherein: 

said array manager is configured such that in response to detecting a first data integrity 
error in a first vertical redundant relationship, detecting a second data integrity 
5 error in a second vertical redundant relationship, and detecting a third data 

integrity error in the horizontal redundant relationship, said array manager: 

creates a first restored data block using the horizontal redundant relationship to 
replace the data block corresponding to the first vertical redundant 
relationship; 

10 compares the first restored data block to the checksum corresponding to the first 

vertical redundant relationship; 

creates a second restored data block using the horizontal redundant relationship to 
replace the data block corresponding to the second vertical redundant 
relationship; and 



1 5 compares the second restored data block to the checksum corresponding to the 

second vertical redundant relationship. 

28. The storage system of Claim 27, wherein: 

said array manager is configured such that said array manager reports a data loss 
20 condition in response to either: 



(a) a mismatch between the first restored data block and the checksum 

corresponding to the first vertical redundant relationship and a mismatch 
between the second restored data block and the checksum corresponding 
to the second vertical redundant relationship; or 

25 (b) a match between the first restored data block and the checksum corresponding 

to the first vertical redundant relationship and a match between the second 
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restored data block and the checksum corresponding to the second vertical 
redundant relationship. 

The storage system of Claim 27, wherein: 

said array manager is configured such that in response to a match between the first 

restored data block and the checksum corresponding to the first vertical redundant 
relationship and a mismatch between the second restored data block and the 
checksum corresponding to the second vertical redundant relationship, said array 
manager creates a restored checksum using the second restored data block to 
replace the checksum corresponding to the second vertical redundant relationship. 

The storage system of Claim 16, wherein: 

said array manager is configured to report a data loss condition in response to detecting 
data integrity errors in at least three of the vertical redundant relationships. 

A computer-readable medium whose contents cause a computer system to operate a 
storage system by performing the steps of: 

detecting a data integrity error in at least one of a plurality of data block having a 
horizontal redundant relationship; and 

analyzing a plurality of checksums, each checksum having a vertical redundant 
relationship with a corresponding one of the plurality of data blocks, said 
analyzing comprising reviewing the vertical redundant relationships between each 
of the checksums in the plurality of checksums and the corresponding data blocks. 

The computer-readable medium of Claim 3 1 , wherein: 
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said reviewing the vertical redundant relationships comprises calculating a new checksum 
for each of the data blocks in the plurality of data blocks and comparing the 
calculated new checksum to the checksum from the plurality of checksums 
corresponding to that data block. 

The computer-readable medium of Claim 3 1 , wherein: 

each data block in the plurality of data blocks has a vertical redundant relationship with a 
set of corresponding checksums, and each of the checksums in the set of 
corresponding checksums has a horizontal checksum redundant relationship with 
the other checksums in the set of corresponding checksums. 

The computer-readable medium of Claim 33, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

in response to detecting a first data integrity error between a first data block and a first 
checksum from a first set of checksums corresponding to the first data block, 
reviewing the vertical redundant relationship between the first data block and the 
remaining checksums in the first set of checksums; and 

in response to detecting no data integrity errors between the first data block and the 
remaining checksums in the first set of checksums, creating a restored first 
checksum to replace the first checksum corresponding to the first data integrity 
error. 

The computer-readable medium of Claim 3 1 , wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the fiirther steps of: 
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in response to detection of a data integrity error in at least one of the plurality of data 
blocks, reviewing the horizontal redundant relationship between the data block 
having the data integrity error and the remaining data blocks in the plurality of 
data blocks. 

The computer-readable medium of Claim 35, wherein: 

said plurality of data blocks comprises a plurality of data stripe units and a parity stripe 
unit; and 

said reviewing the horizontal redundant relationship comprises calculating a new parity 
stripe unit based on the plurality of data stripe units and comparing the calculated 
new parity stripe unit to the parity stripe unit from the plurality of data blocks. 

The computer-readable medium of Claim 35, wherein: 

said plurality of data blocks comprises a first mirrored data block and a corresponding 
second mirrored data block; and 

said reviewing the horizontal redundant relationship comprises comparing the first 
mirrored data block and the second mirrored data block. 

The computer-readable medium of Claim 35, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

in response to detecting a first data integrity error in exactly one of the vertical redundant 
relationships and detecting no data integrity errors in the horizontal redundant 
relationship, creating a restored checksum using the data block corresponding to 
the first data integrity error to replace the existing checksum corresponding to the 
first data integrity error. 
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The computer-readable medium of Claim 35, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

in response to detecting a first data integrity error in exactly one of the vertical redundant 
relationships and detecting a second data integrity error in the horizontal 
redundant relationship, creating a restored data block using the horizontal 
redundant relationship to replace the data block corresponding to the first data 
integrity error and comparing the restored data block to the checksum 
corresponding to the first data integrity error. 

The computer-readable medium of Claim 39, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

in response to a mismatch between the restored data block and the checksum 

corresponding to the first data integrity error, creating a restored checksum using 
the restored data block to replace the checksum corresponding to the first data 
integrity error. 

The computer-readable medium of Claim 35, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

in response to detecting a first data integrity error in a first vertical redundant 

relationship, detecting a second data integrity error in a second vertical redundant 
relationship, and detecting no data integrity errors in the horizontal redundant 
relationship, reporting a data loss condition. 



Page 31 



Atty. Re£: P5599 



The computer-readable medium of Claim 35, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

in response to detecting a first data integrity error in a first vertical redundant 

relationship, detecting a second data integrity error in a second vertical redundant 
relationship, and detecting a third data integrity error in the horizontal redundant 
relationship: 

creating a first restored data block using the horizontal redundant relationship to 
replace the data block corresponding to the first vertical redundant 
relationship; 

comparing the first restored data block to the checksum corresponding to the first 
vertical redundant relationship; 

creating a second restored data block using the horizontal redundant relationship 
to replace the data block corresponding to the second vertical redundant 
relationship; and 

comparing the second restored data block to the checksum corresponding to the 
second vertical redundant relationship. 

The computer-readable medium of Claim 42, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

reporting a data loss condition in response to either: 

(a) a mismatch between the first restored data block and the checksum 

corresponding to the first vertical redundant relationship and a mismatch 
between the second restored data block and the checksum corresponding 
to the second vertical redundant relationship; or 
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(b) a match between the first restored data block and the checksum corresponding 
to the first vertical redundant relationship and a match between the second 
restored data block and the checksum corresponding to the second vertical 
redundant relationship. 

The computer-readable medium of Claim 42, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

in response to a match between the first restored data block and the checksum 

corresponding to the first vertical redundant relationship and a mismatch between 
the second restored data block and the checksum corresponding to the second 
vertical redundant relationship, creating a restored checksum using the second 
restored data block to replace the checksum corresponding to the second vertical 
redundant relationship. 

The computer-readable medium of Claim 31, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

in response to detecting data integrity errors in at least three of the vertical redundant 
relationships, reporting a data loss. 

A storage system, comprising: 

a plurality of storage devices configured to store a plurality of data blocks and a plurality 
of checksums, wherein each data block in said plurality of data blocks has a first 
type of redundant relationship with a corresponding one of the plurality of 
checksums and each data block in said plurality of data blocks has a second type 
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of redundant relationship with the remaining data blocks in said plurality of data 
blocks; and 

an array manager coupled to said plurality of storage devices, wherein said array manager 
is configured to detect a data integrity error in one of the first type of redundant 
5 relationships between the plurality of data blocks and the plurality of checksums 

and to check for additional data integrity errors in the remaining first type of 
redundant relationships between the plurality of data blocks and the plurality of 
checksums. 

The storage system of Claim 46, wherein: 

said array manager is configured to check for additional data integrity errors in the 
remaining first type of redundant relationships between the plurality of data 
blocks and the plurality of checksums by calculating a new checksum for each of 
the data blocks in the plurality of data blocks and comparing the calculated new 
checksum to the checksum from the plurality of checksums corresponding to that 
data block. 



10 47. 



15 



48. The storage system of Claim 46, wherein: 

each data block in the plurality of data blocks has a vertical redundant relationship with a 
20 set of corresponding checksums, and each of the checksums in the set of 

corresponding checksums has a horizontal checksum redundant relationship with 
the other checksums in the set of corresponding checksums. 

49. The storage system of Claim 48, wherein: 

25 said array manager is configured such that in response to detecting a first data integrity 

error between a first data block and a first checksum from a first set of checksums 
corresponding to the first data block, said array manager reviews the redundant 
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relationships between the first data block and the remaining checksums in the first 
set of checksums; and T 

said array manager is further configured such that in response to detecting no data 

integrity errors between the first data block and the remaining checksums in the 
first set of checksums, said array manager creates a restored first checksum to 
replace the first checksum corresponding to the first data integrity error. 

The storage system of Claim 46, wherein: 

said array manager is configured such that in response to detection of a data integrity 

error in at least one of the plurality of data blocks, said array manager reviews the 
second type of redundant relationship between the data block having the data 
integrity error and the remaining data blocks in the plurality of data blocks. 

The storage system of Claim 50, wherein: 

said plurality of data blocks comprises a plurality of data stripe units and a parity stripe 
unit; and 

said array manager is configured to review the second type of redundant relationship by 
calculating a new parity stripe unit based on the plurality of data stripe units and 
comparing the calculated new parity stripe unit to the parity stripe unit from the 
plurality of data blocks. 

The storage system of Claim 50, wherein: 

said plurality of data blocks comprises a first mirrored data block and a corresponding 
second mirrored data block; and 

said array manager is configured to review the second type of redundant relationship by 
comparing the first mirrored data block and the second mirrored data block. 
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The storage system of Claim 50, wherein: 

said array manager is configured such that in response to detecting a first data integrity 
error in exactly one of the first type of redundant relationships and detecting no 
data integrity errors in the second type of redundant relationship, said array 
manager creates a restored checksum using the data block corresponding to the 
first data integrity error to replace the existing checksum corresponding to the first 
data integrity error. 

The storage system of Claim 50, wherein: 

said array manager is configured such that in response to detecting a first data integrity 
error in exactly one of the first type of redundant relationships and detecting a 
second data integrity error in the second type of redundant relationship, said array 
manager creates a restored data block using the second type of redundant 
relationship to replace the data block corresponding to the first data integrity error 
and compares the restored data block to the checksum corresponding to the first 
data integrity error. 

The storage system of Claim 54, wherein: 

said array manager is configured such that in response to a mismatch between the 

restored data block and the checksum corresponding to the first data integrity 
error, said array manager creates a restored checksum using the restored data 
block to replace the checksum corresponding to the first data integrity error. 

The storage system of Claim 50, further comprising: 
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said array manager is configured such that in response to detecting a first data integrity 
error in a first one of the first type of redundant relationship, detecting a second 
data integrity error in a second one of the first type of redundant relationship, and 
detecting no data integrity errors in the second type of redundant relationship, said 
array manager reports a data loss condition. 

The storage system of Claim 50, wherein: 

said array manager is configured such that in response to detecting a first data integrity 
error in a first one of the first type of redundant relationship, detecting a second 
data integrity error in a second one of the first type of redundant relationship, and 
detecting a third data integrity error in the second type of redundant relationship, 
said array manager: 

creates a first restored data block using the second type of redundant relationship 
to replace the data block corresponding to the first one of the first type of 
redundant relationship; 

compares the first restored data block to the checksum corresponding to the first 
one of the first type of redundant relationship; 

creates a second restored data block using the second type of redundant 

relationship to replace the data block corresponding to the second one of 
the first type of redundant relationship; and 

compares the second restored data block to the checksum corresponding to the 
second one of the first type of redundant relationship. 

The storage system of Claim 57, wherein: 

said array manager is configured such that said array manager reports a data loss 
condition in response to either: 
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(a) a mismatch between the first restored data block and the checksum 

corresponding to the first one of the first type of redundant relationship 
and a mismatch between the second restored data block and the checksum 
corresponding to the second one of the first type of redundant relationship; 
or 

(b) a match between the first restored data block and the checksum corresponding 

to the first one of the first type of redundant relationship and a match 
between the second restored data block and the checksum corresponding 
to the second one of the first type of redundant relationship. 

The storage system of Claim 57, wherein: 

said array manager is configured such that in response to a match between the first 

restored data block and the checksum corresponding to the first one of the first 
type of redundant relationship and a mismatch between the second restored data 
block and the checksum corresponding to the second one of the first type of 
redundant relationship, said array manager creates a restored checksum using the 
second restored data block to replace the checksum corresponding to the second 
one of the first type of redundant relationship. 

The storage system of Claim 46, wherein: 

said array manager is configured to report a data loss condition in response to detecting 
data integrity errors in at least three of the first type of redundant relationships. 
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